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Practitioner's Docket No. AMDCPOOl SEP 2 9 2005 PATENT 

IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re application of: Tal Givoly 

Application No.: 09/924,391 GnwpNo.: 2155 

Filed: 08/07/2001 Examiner: Philip B.Tran 

For: SYSTEM, METHOD AND COMPUTER PROGRAM PRODUCT FOR PROCESSING 
NETWORK ACCOUNTING INFORMATION 

Mail Stop Appeal Briefs - Patents 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

TRANSMITTAL OF APPEAL BRIEF 
(PATENT APPLICATTON~37 CJFJL § 1192) 

1. Transmitted herewith is an appeal brief in this application, with respect to the Notice of Appeal 
filed September 29, 2005, which reinstates the appeal originally instated by the Notice of Appeal 
filed on April 20, 2004, and the original appeal brief filed June 21, 2004. It should be noted that 
the present appeal brief is further to serve as a substitute for the appeal brief mailed August 16, 
2005, since such appeal brief did not follow the filing of a proper second Notice of Appeal. 

2. STATUS OF APPLICANT 

This application is on behalf of other than a small entity. 



CERTIFICATION UNDER 37 C.FJL §§ 1.8(a) and 1.10* 

(When using Express Mail, the Express Mail label number is mandatory; 
Express Mail certification is optional) 

I hereby certify that, on the date shown below, this correspondence is being: 

MAJOUNG 

_ deposited with the United States Postal Service in an envelope addressed to the Commissioner for Patents, P-O. Box 1450, Alexandria, VA 
22313-1450. 

37 CF.IL§ 1.8(a) 37 CSJL § 1 JO* 

_ with sufficient postage as first class mail. _ as "Express Mail Post Office to Addressee" 

Mailing tab el No- (mandatory) 

/ TRANSMISSION 

^facsimile transmitted to the Patent and Trademark Office, (571) 273-8300. 



nature 

Data 1 f ^ 1 / ^ C -* J - Jp Erica L. Farlow 




(type or print name, of person certifying) 



* Only tkB date of filing ( ' 1.6) will be the date used m a patent term adjustment calculation, although the date on any certificate of mailing or 
transmission under ' 1.8 continues 10 be taken into account in determining timeliness. See ' 1.703(f). Consider "Express Mail Post Office to 
Addressee" ( * L10) or facsimile transmission (' 1.6(d)) for the reply to be accorded the earliest possible jiling date for patent term adjusttnent 
calculations. 
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3. FEE FOR FILING APPEAL BRIEF 

Pursuant to 37 C.FJL § 1.17(c), the fee for filing the Appeal Brief has already been paid. 
However, the Commissioner is authorized to charge any fees that may be due to deposit account 50-1351 
(Order No. AMDCP001). 

4. EXTENSION OF TERM 

The proceedings herein are for apatent application and the provisions of 37 CJF.R. § 1.136 apply. 

Applicant believes that no extension of term is required. However, this conditional petition is 
being made to provide for the possibility that applicant has inadvertently overlooked the need for a 
petition and fee for extension of time. 

5. TOTAL FEE DUE 
The total fee due is: 

Appeal brief fee $0.00 (previously paid on 6/21/04 & 9/29/05) 

TOTAL FEE DUE $0.00 

6. FEE PAYMENT 

Applicant believes that only the above fees are due in connection with the filing of this paper 
because the appeal brief fee was paid with a previous submission. However, the Commissioner is 
authorized to charge any additional fees that may be due (e.g. for any reason including, but not 
limited to fee changes, etc.) to deposit account 50-1351 (Order No. AMDCP001). 

A duplicate of this transmittal is attached. 

7- FEE DEFICIENCY 

If any additional extension and/or fee is required, and if arry^riSrfort^ fee claims is required, 
charge Deposit Account No. 50-1 35 1 (Order No. AMDCpflO ty-Jy / 



Reg. No.: 41,429 
TeL No,: 408-971-2573 
Customer No.: 28875 




'USA 
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TRANSMTTTAL OF APPEAL BRIEF 
(PATENT APPLICATION— 37 CJFJL § 1192) 

1, Transmitted herewith is an appeal brief in this application, with respect to the Notice of Appeal 
filed September 29, 2005, which reinstates the appeal originally instated by the Notice of Appeal 
filed on April 20, 2004, and the original appeal brief filed June 21, 2004. It should be noted that 
the present appeal brief is further to serve as a substitute for the appeal brief mailed August 16, 
2005, since such appeal brief did not follow the filing of a proper second Notice of Appeal. 

2> STATUS OF APPLICANT 

This application is on behalf of other than a small entity. 
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3. FEE FOR FILING APPEAL BRIEF 

Pursuant to 37 CF.R. § 1.17(c), the fee for filing the Appeal Brief has already been paid. 
However, the Commissioner is authorized to charge any fees that may be due to deposit account 50-1351 
(Order No. AMDCP001). 

4. EXTENSION OF TERM 

The proceedings herein ate for a patent application and the provisions of 37 C JiL §1.136 apply. 

Applicant believes that no extension of term is required. However, this conditional petition is 
being made to provide for the possibility that applicant has inadvertently overlooked the need for a 
petition and fee for extension of time. 

5. TOTAL FEE DUE 
The total fee due is; 

Appeal brief fee $0.00 (previously paid on 6/21/04 & 9/29/05) 

TOTAL FEE DUE $0.00 

6. FEE PAYMENT 

Applicant believes that only the above fees are due in connection with the filing of this paper 
because the appeal brief fee was paid with, a previous submission. However, the Commissioner is 
authorized to charge any additional fees that may be due (e.g. for any reason including, but not 
limited to fee changes, etc.) to deposit account 50-1351 (Order No. AMDCP001). 

A duplicate of this transmittal is attached. 

7. FEE DEFICIENCY 

If any additional extension and/or fee is required, and if any>aiI^onai fee ftfr claims is required, 
charge Deposit Account No. 50-1351 (Order No. AMDCpflOl). / 
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RECEIVED 
CENTRAL FAX CENTER 

SEP 2 9 2005 



IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



In re the application of 



Givoly 



) Group Art Unit 2155 



Application No. 09/924,391 



) Examiner: Tran, Philip B. 



Filed: 



08/07/01 



) Attorney Docket No. AMDCPOOl 
) 



For 



SYSTEM, METHOD AND COMPUTER) 



PROGRAM PRODUCT FOR ) 
PROCESSING NETWORK ) 
ACCOUNTING INFORMATION ) 



Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

ATTENTION: Board of Patent Appeals and Interferences 

SUPPLEMENTAL APPEAL BRIEF (37 C.F.R. § 4137) 

This brief is in furtherance of the Notice of Appeal filed September 29, 2005, which 
reinstates the appeal originally instated by the Notice of Appeal filed on April 20, 
2004, and the original appeal brief filed June 21, 2004. It should be noted that the 
present appeal brief is farther to serve as a substitute for the appeal brief mailed 
August 16, 2005, since such appeal brief did not follow the filing of a proper second 
Notice of Appeal. 

The fees required under § 1.17, and any required petition fot extension of time for filing 
this brief and fees therefor, are dealt with in the accompanying TRANSMITTAL OF 
APPEAL BRIEF. 

This brief contains these items under the following headings, and in the order set forth 
below (37 C.F.R. § 41.37(c)(0): 

I REAL PARTY IN INTEREST 

H RELATED APPEALS AND INTERFERENCES 

m STATUS OF CLAIMS 



PAGE 6132 * RCVD AT 9/29/2005 7:19:33 PM [Eastern Daylight Time] * SVR:USPTO-EFXRM/25 ' DNIS:2738300 ' CSID:4089714660 * DURATION (mm-ss):05-54 



SEP. 29. 2005 4:30PM 



ZILKA-KOTAB, PC 



-2- 



NO.0402 P. 7/32 



IV STATUS OF AMENDMENTS 

V SUMMARY OF CLAIMED SUBJECT MATTER. 

VI ISSUES 

VH ARGUMENTS 

Vm APPENDIX OF CLAIMS INVOLVED IN THE APPEAL 

K APPENDIX LISTING ANY EVIDENCE RELIED ON BY THE APPELLANT 

IN THE APPEAL 

The final page of (bis brief bears the practitioner's signature. 
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I REAL PARTY IN INTEREST (37 C.F.R. § 41.37(c)(l)(i)) 
The real party in interest In this appeal is Xacct Technologies, Ltd. 
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n RELATED APPEALS AND INTERFERENCES (37 C.F.R. § 4137(c) (1)(U)) 

With respect to other prior or pending appeals, interferences, or related judicial 
proceedings that will directly affect, or be directly affected by, or have a bearing on the 
Board's decision to the pending appeal, there are no other such appeals, interferences, or 
related judicial proceedings. 

Since no such proceedings exist, no Related Proceedings Appendix is appended hereto. 
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HI STATUS OF CLAIMS (37 CF.R. § 41.37(c) (l)(iii)) 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 
Claims In the application are: 1, 3-5, 7-1 1, 13-14, 16-20, and 23 

B. STATUS OF ALL THE CLAIMS IN APPLICATION 

1 . Claims withdrawn from consideration: None 

2. Claims pending: 1, 3-5, 7-1 1, 13-14, 16-20, and 23 

3. Claims allowed: None 

4. Claims rejected: 1 , 3-5. 7-11, 13-14, 16-20, and 23 

C. CLAIMS ON APPEAL 

The claims on appeal are: 1, 3-5, 7-1 1, 13-14, 16-20, and 23 
See additional status information in the Appendix of Claims. 
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IV STATUS OF AMENDMENTS (37 C.FJ*. § 41.37(c)(l)(iv)) 

As to the status of any amendment filed subsequent to final rejection, there are no such 
amendments after final. 
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V SUMMARY OF CLAIMED SUBJECT MATTER (37 CF.R* § 41J7(c)(l)(v)) 

With respect to Claim I et al., as set forth in Figure 4 and the accompanying 
description of the originally filed specification, a method is provided for processing 
network accounting information. Accounting information is initially received over a 
packet-switched network. Note operation 402 in Figure 4 and the accompanying 
description. At Least one aspect of the received accounting information is then 
monitored. In use, at least a portion of the accounting information that occurs 
during a surge in network traffic is discarded, based on the monitored aspect. Note 
operation 420 in Figure 4 and the accompanying description. Further, the portion of 
the accounting information is discarded to prevent an overload of subsequent 
processing. Note page 5, first paragraph. 

With respect to Claim 1 1 et aL, as set forth in Figure 4 and the accompanying 
description of the originally filed specification, a computer program product is 
provided for processing network accounting information. Accounting information is 
initially received over a packet-switched network. Note operation 402 in Figure 4 
and the accompanying description. At least one aspect of the received accounting 
information Is then monitored. In use, at least a portion of the accounting 
information that occurs during a surge in network traffic (and is expendable) is 
discarded, based on the monitored aspect. Note operation 420 in Figure 4 and the 
accompanying description. Further, the portion of the accounting information is 
discarded to prevent an overload of subsequent processing. Note page 5, first 
paragraph. Still yet, at least a portion of remaining accounting information is 
allowed to pass to subsequent accounting processing, after receiving the accounting 
information. 

With respect to Claim 20 et al., as set forth in Figure 4 and the accompanying 
description of the originally filed specification, a computer program product is 
provided for processing network accounting information. Accounting information is 
initially received over a packet-switched network. Note operation 402 in Figure 4 
and the accompanying description. At least one aspect of the received accounting 
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information is then monitored. In use, at least a portion of the accounting 
information that occurs during a surge in network traffic (and is expendable) is 
discarded, based on the monitored aspect. Note operation 420 in Figure 4 and the 
accompanying description. Further, the portion of the accounting information is 
discarded to prevent an overload of subsequent processing, Note page 5, first 
paragraph. Still yet, at least a portion of the accounting information is aggregated 
prior to passing to subsequent accounting processing, based on the monitored aspect, 
after receiving the accounting information. Even still, the portions of the accounting 
information arts discarded and aggregated to prevent an overload of the subsequent 
accounting processing, and the subsequent accounting processing includes operation 
and business support system processing. Note operation 420 in Figure 4 and the 
accompanying description. 
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VI ISSUES (37 C.F.R. § 41.37(c)(l)(vi)) 

Following, under each issue listed, is a concise statement setting forth the corresponding 
ground of rejection. 

Issue # 1 : The Examiner has rejected Claims 1, 3-5, 7-1 1 , 13-14, 16-20 and 23 under 
35 U.S.C. 103(a) as being unpatentable over Conklm et al. (USPN 5,991,881) in 
view of Engel et al. (USPN 6,1 15,393). 
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Vn ARGUMENTS (37 C.F.R. § 41.37(c)(l)(vii)) 

The claims of the groups noted below do not stand or fall together. In the present 
section, appellant explains why the claims of each group are believed to be separately 
patentable. 

Issue #1: 

lssue# 1: The Examiner has rejected Claims 1, 3-5, 7-11, 13-14, 16-20 and 23 under 
35 U.S.C. 103(a) as being unpatentable over Conklin et al. (USPN 5,991,881) in 
view of Engel et al. (USPN 6,1 15,393). 

Group #/: Claims 1, 5, 9-10, 18-19, and 23 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references 
themselves or in the knowledge generally available to one of ordinary skill in the art, 
to modify the reference or to combine reference teachings. Second, there must be a 
reasonable expectation of success. Finally, the prior art reference (or references 
when combined) must teach or suggest all the claim limitations. The teaching or 
suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on appellant's disclosure. 
In re Vaec^l F,2d 488, 20 USPQ2d 1438 (Fed.Cir.199t). Appellants respectfully 
assert that at least the first and third elements of the prima facie case of obviousness 
have not been met- 

With respect to the first element of the prima facie case of obviousness, the 
Examiner states that it would have been obvious to one of ordinary skill in the art at 
the time of the invention was made to incorporate the teaching of Engel into the 
teaching of Conklin in order to efficiently monitor and control the network account 
information for preventing the overload situation of information in the network 
account information. Appellant respectfully disagrees with this proposition, 
especially in view of the vast evidence to the contrary. 
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Specifically, the Examiner equates, in the latest action, appellant's claimed 
"accounting information" to include the attack data shown in Figure 7 from Conklin, 
in the context of appellant's claimed "discarding at least a portion of the accounting 
information • , . based on the monitored aspect See below. 



The Examiner then relies on col. 12, lines 7-67 from Engel to meet appellant's 
claimed "wherein the portion of the accounting information is discarded to prevent 
an overload of subsequent processing." However, the only mention of any sort of 
discarding in such excerpt is as follows; 

tt EM 36 also implements a throttle mechanism to limit the rate 
of delivery of alarms to the console based on configured 
limits. This prevents the rapid generation of multiple alarms, 
in essence, Monitor 10 is given a maximum frequency at which 
alarms may be sent to the Workstation. Although alarms in 
excess of the maximum frequency are discarded, a count is kept 
of the number of alarms that were discarded." (col. 12, lines 
50-56) 

Thus, it is clear that the Examiner, in the foregoing excerpt, is equating appellant's 
claimed accounting information with Engel's alarms, which are discarded in Engel. 
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To this end, the Examiner's proposed combination attempts to provide the 
functionality associated with the "attack data" of Conklin with the functionality of 
the "alarms" of Engel, To simply glean features associated with alarms, such as that 
of Engel, and combine the same with the noixmalogous art of attack data, such as 
that of Conklin would simply be improper. Attack data is used for attempting to 
identify attacks, etc., while alarms provide a notice to a user of some sort of event. 

"In order to rely on a reference as a basis for rejection of an appellant's invention, 
the reference must either be in the field of appellant's endeavor or, if not, then be 
reasonably pertinent to the particular problem with which the inventor was 
concerned." In re Oetiker, 977 F.2d 1443, 1446, 24 USPQ2d 1443, 1445 (Fed. Cir. 
1992), See also In re Deminski, 796 F.2d 436, 230 USPQ 313 (Fed. Cir. 1986); In re 
Clay, 966 F.2d 656, 659, 23 USPQ2d 1058, 1060-61 (Fed Cir, 1992) In view of the 
vastly different types of problems attack data addresses as opposed to alarms, the 
Examiner's proposed combination is inappropriate, 

Further, any attempt to incorporate alarm functionality with the collection/use of 
attack data would render an vnworkabh combination. Alarms are merely notices of 
an "exception," etc. based on various criteria. For example, in Engel, the alarms are 
specifically equipped **to notify the Management Workstation of the occurrence of 
significant events." This is in no way compatible with the attack data 
collection/analysis functionality of Conklin for numerous reasons (e.g. the alarms 
are managed far "downstream" with respect to the data collection, etc.). 

Note, for example, the very different modules that carry out the respective functions 
in Engel (e.g. alarm module 38 vs. RTP 32) and Conklin (e.g. alert notification - Fig. 
6C vs. network observation/detection - Fig, 6A, 6B) below; 
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Even appellant's own disclosure (see below) reflects the vast difference in the 
modules handling data collection/analysis vs. alarms 
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302 



306 



FIGURE 3 

Further, the only context in which Conklin even suggests any sort of discarding of 
data is in the following excerpt: 
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*lf, there is no indication of an actual or potential 
intrusion, then the examined packet data is discarded, when a 
packet or accumulation of packets match a predefined intrusion 
profile the intrusion Detection function identifies the 
network traffic as a reportable activity will construct a data 
Btructure which contains a date/time stamp indicating the time 
of detection, the source and destination Internet Protocol 
(IP) addresses, an assigned message identifying the event 
detected. Itois data structure is passed to the Alert 
Notification function for processing." (see col- 5, lines 23- 
32) 

Thus, while appellant teaches and claims discarding accounting information when 
such accounting information occurs during a surge in network traffic (which may or 
may not be resulting from an attack), Conklin discards packet data when there is no 
indication of an actual or potential intrusion . Thus, not only do Conklin's teachings 
fail to meet appellant's claims, but Conklin teaches away from appellant's claimed 
invention (as well as Engel's), thus further rendering it mobvions. In re Hedges, 783 
F.2d 1038, 228 USPQ 685 (Fed. Cir. 1986). 

Appellant thus respectfully asserts that the first element of the prima facie case of 
obviousness has not been met, for at least the reasons set forth hereinabove. 

More importantly, with respect to the third element of the prima facie case of 
obviousness, the Examiner equates, in the latest action, appellant's claimed 
"accounting information" to include the attack data shown in Figure 7. See below. 
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The Examiner continues by presenting the following argument with respect to 
appellant's claimed "discarding at least a portion of the accounting information ... 
based on the monitored aspect " 

conklin allegedly teaches: "(i.e., network traffic measurement 
and monitoring for reporting information about captured 
packets and detecting intrusion into the network and into 
computers connected to the network for denial of service) [see 
Abstract and Figs. 6-9 and Col. 1, Line 10 - Col. 2, fcine 4.]" 

However, even if the Examiner's statement is true (i.e. that Conklin suggests 
network traffic measurement and monitoring for , . .), the Examiner has still not 
shown how Conklin meets appellant's claimed "discarding at least a portion of the 
accounting information that occurs during a surge in network traffic, based on the 
monitored aspect" 

Specifically, the Examiner has not shown how the attack data (which the Examiner 
relies on to meet appellant's claimed "accounting information 5 *) is discarded when 
such attack data occurs during a surge in network traffic, based on the monitored 
aspect. 
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Appellant thus respectfully asserts that the third element of the prima facie case of 
obviousness has not been met, since the Examiner's proposed combination does not 
disclose, teach or suggest appellant's claim language, as set forth hereinabove. 

Still yet, the Examiner admits that "Conklin does not explicitly teach the portion of 
the accounting information is discarded to prevent an overload of subsequent 
processing*" The Examiner then relies on col. 12, lines 7-67 to meet appellant's 
claimed "wherein the portion of the accounting information is discarded to prevent 
an overload of subsequent processing." 

As mentioned previously, the only mention of any sort of discarding in such excerpt 
is as follows: 

"EM 38 also implement© a throttle mechanism to limit the rate 
of delivery of alarms to the console based on configured 
limits. This prevents the rapid generation of. multiple alarms - 
In essence, Monitor 10 is given a maximum frequency at which 
alarms may be sent to the Workstation. Although alarms in 
excess of the maximum frequency are discarded, a count is kept 
of the number of alarms that were discarded." (col. 12, lines 

50-56) 

Appellant argues that the disclosed "alarms" do not meet appellant's claimed 
"accounting information. 0 Again, in Engel, the alarms are specifically equipped "to 
notify the Management Workstation of the occurrence of significant events/* Such 
notification in no AVay includes information, let alone accounting information, as 
claimed by appellant. Further, Engel's discarding is purposed to prevent the rapid 
generation of alarms, which simply does not rise to the level of specificity of 
appellant's claimed discarding to prevent an overload of subsequent processing, as 
claimed. 

Again, appellant thus respectfully asserts that the third element of the prima facie 
case of obviousness has not been met, since the Examiner's proposed combination 
does noj disclose, teach or suggest appellant's claim language, as set forth 
hereinabove. 
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Group #2: Claims 3 and 13 

With respect to Claims 3 and 13, the Examiner continues to rely on Figure 6 from 
Conklin to make a prior art showing of appellant's claimed therein the accounting 
information is discarded for dealing with heavy network traffic." After careful of 
Figure 6, it clearly fails to disclose, teach or even suggest such limitations. Again, 
Conklin deals with network attacks, not "dealing with heavy network traffic," by 
discarding accounting information^ as claimed. 

Again, appellant thus respectfully asserts that the third element of the prima facie 
case of obviousness has not been met, since the Examiner's proposed combination 
does not disclose, teach or suggest appellant's claim language, as set forth 
hereinabove. 

Group #3: Claims 4 and 14 

With respect to Claims 4 and 14, the Examiner relies on col. 4, line 52 - col. 5, line 
45 from Conklin to make a prior art showing of appellant's claimed "generating a 
Summary of the accounting information." Such excerpts^ however, do not disclose, 
teach or even suggest "accounting information," let alone "generating a summary of 
the accounting information," as claimed. 

Again, appellant thus respectfully asserts that the third element of the prima facie 
case of obviousness has not been met, since the Examiner's proposed combination 
does not disclose, teach or suggest appellant's claim language, as set forth 
hereinabove. 

Group #4: Claims 7 and 16 
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Regarding Claims 7 and 16, the Examiner relies on col, 4, line 30-67; and Figures 6- 
8 from Conklin to make a prior art showing of appellant's claimed "wherein 
monitoring the at least one aspect of the received accounting information includes 
monitoring a rate of receipt of the accounting information." Such excerpts^ 
however, do not disclose, teach or even suggest "a rate of receipt of the accounting 
information." Instead, there is a meTe mention of a time of day, number and types of 
packets, common destination/source address combinations, etc, A number of packets 
constitutes an amount, not a "rate," as claimed. 

Again, appellant thus respectfully asserts that the third element of the prima facie 
case of obviousness has not been met, since the Examiner's proposed combination 
does not disclose, teach or suggest appellant's claim language, as set forth 
hereinabove. 

Group #5: Claims 8 and 1 7 

With respect to Claims 8 and 17, the Examiner relies on col. 4, lines 30-67; and 
Figures 6-8 from Conklin to make a prior art showing of appellant's claimed 
'"wherein monitoring the at least one aspect of the received accounting information 
includes detecting whether the rate of receipt of the accounting information exceeds 
a predetermined amount. 5 * Such excerpts, however, do not even disclose, teach or 
suggest "a rate of receipt of the accounting information." Instead, there is a mere 
mention of a time of day, number and types of packets, common destination/source 
address combinations, etc. It is noted that Conklin does not even suggest a "rate," 
let alone "detecting whether the rate of receipt of the accounting information 
exceeds a predetermined amount " as claimed. 

Yet again, appellant thus respectfully asserts that the third element of the prima facie 
case of obviousness has not been met, since the Examiner's proposed combination 
does not disclose, teach or suggest appellant's claim language, as set forth 
hereinabove. 

Group #6: Claim 11 
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The present group is deemed allowable for, at least in part, the reasons set forth with 
respect to Group #1 . Furthermore, the Examiner has simply dismissed at least a portion 
of the contents of Claim 1 1 under the same rationale set forth above to Claim 1 . 
However, Claim 1 1 includes the following limitations, not found in Claim 1: 

"computer code for discarding at least a portion of the accounting 
information that occurs during a surge in network traffic and is expendable, 
based on the monitored aspect, after receiving the accounting information; 

computer code for allpwinp at least a portion of remaining accounting 
information to pass to subsequent accounting processing, after receiving the 
accounting information: 

wherein the portion of the accounting information is discarded to 
prevent an overload of the subsequent accounting processing (emphasis 
added). 

TTius, in the present claim, it is further emphasized that expendable information is 
discarded, while at least a port ion of remaining accounting information is allowed to 
pass to subsequent accounting processing . Only appellant teaches and claims such 
technique of ensuring that only a certain type of information, namely expendable 
information, is discarded, for optimizing operation. Further, information (not including 
the expendable information), is allowed to pass, to subsequent accounting processing, so 
that such accounting- specific processing may continue on the remaining accounting 
information, as claimed. 

Still yet again, appellant thus respectfully asserts that the third element of the prima 
facie case of obviousness has not been met, since the Examinees proposed 
combination does not disclose, teach or suggest appellant's claim language, as set 
forth hereinabove. 

Group #5: Claim 20 
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The present group is deemed allowable for, at least in part, the reasons set forth with 
respect to Group #1. Furthermore, the Examiner has simply dismissed at least a portion 
of the contents of Claim 20 under the same rationale set forth above to Claim 1 . 
However, Claim 20 includes the following limitations, not found in Claim ] ; 

" logic for aggregating atteast a portion of the accounti ng information 
prior to passing to subsequent accounting processing, based on the m onitored 
aspect after receiving the accounting information; 

logic for allowing at least a portion of remaining accounting 
Information to pass to the subsequent accounting processing, after receiving 
the accounting information; 

wherein the portions of the accountin g information are discarded and 
aggregated to prevent an overload of the subsequent accounting processing; 

wherein the subsequent accounting processing includes operation and 
business support system processing , (emphasis added), 

In the present claim, it is further emphasized that an aggregation function is 
implemented in combination with the discarding to prevent an overload of 
subsequent accounting processing, The instant claim further emphasizes the feet 
that the subsequent accounting processing includes operation and business support 
system processing , Only appellant teaches and claims such a combination of 
features and components for preventing an overload of subsequent accounting 
processing. 

Still yet again, appellant thus respectfully asserts that the third element of the prima 
facie case of obviousness has not been met, since the Examiner's proposed 
combination does not disclose, teach or suggest appellant's claim language, a$ set 
forth hereinabove. 

In view of the remarks set forth hereinabove, all of the independent claims are deemed 
allowable, along with any claims depending therefrom. 
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Vm APPENDIX OF CLAIMS (37 C JJl. § 41 J7(c)(l)(viii)) 

The text of the claims involved in the appeal (along with associated status information) 
is set forth below; 

1 . (Previously Presented) A method for processing network accounting 
information, comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) monitoring at least one aspect of the received accounting information; and 

(c) after receiving the accounting information, discarding at least a portion of the 
accounting information that occurs during a surge in network traffic, based 
on the monitored aspect; 

wherein the portion of the accounting information is discarded to prevent an 
overload of subsequent processing. 

2. (Cancelled) 

3- (Original) The method as recited in claim 1 , wherein the accounting 
information is discarded fot dealing with heavy network traffic. 

4. (Original) The method as recited in claim 3, and further comprising 
generating a summary of the accounting information. 

5. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes detecting a scan 
of a plurality of ports. 

6. (Cancelled) 

7. (Original) The method as recited in claim 1 , wherein monitoring the at least 
one aspect of the received accounting information includes monitoring a rate 
of receipt of the accounting information. 
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8. (Original) The method as recited in claim 7, wherein monitoring the at least 
one aspect of the received accounting information includes detecting whether 
the rate of receipt of the accounting information exceeds a predetermined 
amount. 

9. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes monitoring a load 
on a system receiving the accounting information. 

1 0. (Original) The method as recited in claim 1 , wherein the network includes 
the Internet. 

1 1 . (Previously Presented) A computer program product for processing network 
accounting information, comprising: 

computer code for receiving accounting information over a packet-switched 
network; 

computer code for monitoring at least one aspect of the received accounting 
information; and 

computer code for discarding at least a portion of the accounting information 
that occurs during a surge in network traffic and is expendable, based on the 
monitored aspect, after receiving the accounting information; 
computer code for allowing at least a portion of remaining accounting 
information to pass to subsequent accounting processing, after receiving the 
accounting information; 

wherein the portion of the accounting information is discarded to prevent an 
overload of the subsequent accounting processing, 

12. (Cancelled) 

13. (Original) The computer program product as recited in claim 1 1 , wherein the 
accounting information is discarded for dealing with heavy network traffic. 
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14. (Original) The computer program product as recited in claim 1 3, and further 
comprising computer code for generating a summaiy of the accounting 
information. 

15. (Cancelled) 

16. (Original) The computer program product as recited in claim 1 1, wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for monitoring a rate of 
receipt of the accounting information, 

17. (Original) The computer program product as recited in claim 16, wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting whether the 
rate of receipt of the accounting information exceeds a predetermined 
amount. 

1 8. (Original) The computer program product as recited in claim 1 1, wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting a scan of a 
plurality of ports. 

1 9. (Original) The computer program product as recited in claim 1 1 , wherein the 
computer code foT monitoring the at least one aspect of the received 
accounting information includes computer code for monitoring a load on a 
system receiving the accounting information. 
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20. (Previously Presented) A system for processing network accounting 
information, comprising: 

logic for receiving accounting information over a packet-switched network; 
logic for monitoring at least one aspect of the received accounting 
information; and 

logic for discarding at least a portion of the accounting information that 
occurs during a surge in network traffic and is expendable, based on the 
monitored aspect, after receiving the accounting information; 
logic for aggregating at least a portion of the accounting information prior to 
passing to subsequent accounting processing, based on the monitored aspect, 
after receiving the accounting information; 

logic for allowing at least a portion of remaining accounting information to 
pass to the subsequent accounting processing, after receiving the accounting 
information; 

wherein the portions of the accounting information are discarded and 
aggregated to prevent an overload of the subsequent accounting processing; 
wherein the subsequent accounting processing includes operation and 
business support system processing. 

21. (Cancelled) 

22. (Cancelled) 

23. (Previously Presented) A method for processing network accounting 
information, comprising; 

(a) receiving accounting information over a packet-switched network; 

(b) detecting a scan of a plurality of ports; 

(c) detecting a scan of a plurality of Internet Protocol (IP) addresses; 

(d) detecting a rate of receipt of the accounting information; 

(e) detecting whether the rate of receipt of the accounting information exceeds a 
predetermined amount; 

(f) detecting a load on a system receiving the accounting information; 
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(g) conditionally preventing an overload of the accounting information based on 
aspects detected during steps (b)-(f) by discarding at least a portion of the 
accounting information after the receipt thereof to prevent an overload of 
subsequent accounting processing; and 

(h) generating a summary of the accounting information; 

(0 wherein the accounting information that occurs during a surge in network traffic 
is discarded. 
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IX APPENDIX LISTING ANY EVIDENCE RELIED ON BY THE APPELLANT 
IN THE APPEAL (37 GF.R. § 4137(c)(l)(ix)) 

There is no such evidence. 
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In the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the undersigned at (408) 971-2573. For payment of any additional fees due in 
connection with the filing of this paper, the Commissioner is authorized to charge such fees to 
Deposit Account No. 50-1351 (Order No. AMDCP001). 

Respectfully submii 

By: jfc^ / Date: 

Kevin J. Zilki 
Reg. No. 41,429 

Zilka-KotaJ<P.C. 
P.O. Box/721120 
San Jose, California 95172-1120 
Telephone: (408) 971-2573 
Facsimile: (408)971-4660 

\ 
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